linkedin-growth

SUSPICIOUS: the workflow mostly matches its stated LinkedIn-growth purpose, but it relies on an unofficial third-party CLI that handles LinkedIn session authorization and can be installed through risky GitHub installer patterns. The local DB/log design is coherent, yet the combination of credential forwarding to external tooling and autonomous outreach scheduling makes the skill high-risk even without clear evidence of malware.

This module functions as a cross-platform persistence/task-scheduling installer that repeatedly executes a package-provided script (tick.mjs) via launchd/systemd/cron/schtasks. In the shown fragment there is no direct evidence of malware behaviors such as network exfiltration or credential theft, but the code has significant security sensitivity due to enabling recurring background execution and due to injection-prone string interpolation when embedding PATH and command arguments into scheduler configuration (especially the cron line with shell redirection). Full risk assessment requires reviewing the executed tick.mjs and any referenced helper modules (paths/config) for the actual behavior of the scheduled task.